Local Search

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:48 AM UTC
• Version: 1.6.2

Overview

The skill is a coherent local web-search tool, but its main instructions under-disclose that default searches go to Brave first.

Review this before installing if your searches may contain confidential project names, incidents, internal URLs, or personal data. By default, the code may send searches to Brave before DuckDuckGo, Bing, or Google despite the main instructions saying otherwise; explicitly choose an engine when provider control matters.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

other

Warning

• Location: src/engines/index.ts:19

Finding

Undisclosed Default Transmission of Search Queries to Brave Search

Content

View full analysis

0) { if (recency_days <= 1) url.searchParams.set("tf", "pd"); else if (recency_days <= 7) url.searchParams.set("tf", "pw"); else if (recency_days <= 30) url.searchParams.set("tf", "pm"); else url.searchParams.set("tf", "py"); } html = await fetchHtml(url.toString(), { fetchImpl, headers, timeoutMs, }); ``` However, the Skill instructions describe a different default chain: ```markdown When `engine: "auto"` (the default), the orchestrator tries engines in this order: 1. **DuckDuckGo** 2. **Bing** 3. **Google** ``` ### Technical Analysis Sending a query to a search provider is necessary for the declared web-search functionality. The security issue is the discrepancy between the declared privacy boundary and the implemented behavior. A user invoking the default `engine: "auto"` mode is ...[truncated 1863 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: package.json:28

Finding

Unpinned Installer and Dependency Resolution Create Supply-Chain Exposure

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (48)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

The code generally aligns with the declared purpose of a local web search tool and does not show unrelated or dangerous behavior. However, there are material description-to-behavior discrepancies. The implementation supports Brave as a search engine, which is not mentioned in the declared description. It also exposes additional user-facing options (--engine, --timeout, --pretty, --quiet) not described. Most importantly, the declared description specifies a concrete automatic fallback chain of DuckDuckGo -> Bing -> Google, but this code chunk does not substantiate that exact behavior; instead it delegates to search() with engine values including auto and Brave, so the precise fallback order is not verified here. These are not severe purpose changes, but they are meaningful mismatches between the declared description and observed behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence

Finding

The code is broadly consistent with a local web-search helper module, so the primary purpose aligns. However, the declared description is specifically about scraping DDG/Bing/Google with engine fallback and structured output options, while this code chunk is a shared utility layer that also introduces additional behavior: query rewriting/disambiguation, heuristic locale detection, result quality scoring, cross-engine merging/deduplication, and news-homepage filtering. Those are material behaviors beyond simple scraping helpers. More notably, the engine list explicitly includes 'brave', which conflicts with the declared set of engines. Because the actual code still fits within a web-search skill but has at least one concrete capability mismatch and several undeclared material processing behaviors, this is best classified as a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description specifically represents the skill as scraping DuckDuckGo, Bing, and Google directly with a DDG -> Bing -> Google fallback chain. The supplied code instead implements a Brave Search engine backend, including Brave-specific request parameters, rate-limit handling, and Brave HTML parsing. While this is still within the broader category of web search, it materially differs from the declared engine set and external resources accessed. This is more than a minor implementation detail because the description explicitly enumerates the supported search engines and fallback behavior, and the code adds/substitutes a distinct provider not disclosed in the description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The code chunk is still clearly part of a local web search skill, so its primary purpose aligns broadly with the description. However, the declared description is specific about which engines are used and the fallback sequence. The implementation includes an additional undeclared engine (Brave) and prioritizes it first in auto mode. That is a material behavioral mismatch because it changes which external resource is contacted and the actual fallback behavior users would experience.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The code is clearly within the general domain of local web search orchestration, so the primary purpose broadly matches. However, the declared description is materially inaccurate in key behavioral details. The actual code supports Brave as an engine and assigns it trust weights, which contradicts the stated engine set and fallback chain. In auto mode it does not simply fall back from DDG to Bing to Google; it evaluates result quality, may continue past a working engine, and can merge multiple engines' results into a consensus-ranked set. Those are substantive behavioral differences, not minor implementation details. There is no evidence here of unrelated capabilities such as exfiltration or non-search resource access, but the description still does not accurately represent the actual behavior.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

md

- **CLI + SDK** — use `tsx bin/web-search.ts <query>` for one-offs, or `import { search } from "local-search"` in code.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

md

- **CLI + SDK** — use `tsx bin/web-search.ts <query>` for one-offs, or `import { search } from "local-search"` in code.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

md

- **CLI + SDK** — use `tsx bin/web-search.ts <query>` for one-offs, or `import { search } from "local-search"` in code.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

md

- **CLI + SDK** — use `tsx bin/web-search.ts <query>` for one-offs, or `import { search } from "local-search"` in code.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 108)May include surrounding context.

md

- **CLI + SDK** — use `tsx bin/web-search.ts <query>` for one-offs, or `import { search } from "local-search"` in code.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 119)May include surrounding context.

md

- **CLI + SDK** — use `tsx bin/web-search.ts <query>` for one-offs, or `import { search } from "local-search"` in code.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 149)May include surrounding context.

md

- **CLI + SDK** — use `tsx bin/web-search.ts <query>` for one-offs, or `import { search } from "local-search"` in code.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 155)May include surrounding context.

md

- **CLI + SDK** — use `tsx bin/web-search.ts <query>` for one-offs, or `import { search } from "local-search"` in code.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 158)May include surrounding context.

md

- **CLI + SDK** — use `tsx bin/web-search.ts <query>` for one-offs, or `import { search } from "local-search"` in code.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 160)May include surrounding context.

md

- **CLI + SDK** — use `tsx bin/web-search.ts <query>` for one-offs, or `import { search } from "local-search"` in code.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 167)May include surrounding context.

md

- **CLI + SDK** — use `tsx bin/web-search.ts <query>` for one-offs, or `import { search } from "local-search"` in code.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 169)May include surrounding context.

md

- **CLI + SDK** — use `tsx bin/web-search.ts <query>` for one-offs, or `import { search } from "local-search"` in code.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 171)May include surrounding context.

md

- **CLI + SDK** — use `tsx bin/web-search.ts <query>` for one-offs, or `import { search } from "local-search"` in code.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 173)May include surrounding context.

md

- **CLI + SDK** — use `tsx bin/web-search.ts <query>` for one-offs, or `import { search } from "local-search"` in code.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 180)May include surrounding context.

md

- **CLI + SDK** — use `tsx bin/web-search.ts <query>` for one-offs, or `import { search } from "local-search"` in code.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 182)May include surrounding context.

md

- **CLI + SDK** — use `tsx bin/web-search.ts <query>` for one-offs, or `import { search } from "local-search"` in code.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 189)May include surrounding context.

md

- **CLI + SDK** — use `tsx bin/web-search.ts <query>` for one-offs, or `import { search } from "local-search"` in code.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 192)May include surrounding context.

md

- **CLI + SDK** — use `tsx bin/web-search.ts <query>` for one-offs, or `import { search } from "local-search"` in code.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 199)May include surrounding context.

md

- **CLI + SDK** — use `tsx bin/web-search.ts <query>` for one-offs, or `import { search } from "local-search"` in code.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 433)May include surrounding context.

md

- **CLI + SDK** — use `tsx bin/web-search.ts <query>` for one-offs, or `import { search } from "local-search"` in code.

Static analysis

No suspicious patterns detected.